Press and media

Email security data for UK healthcare

Original research on how well dental practices, care homes and GP practices protect their email from impersonation. Free to quote and reuse with credit. Founder Andrew Heppinstall is available for comment and interview.

Email a media enquiry Call 07749 941111

Latest research · October 2026

England dental practice email security benchmark

We checked the public email set-up of 3,325 dental practice websites registered with the CQC in England, covering every region. Most practices could have their email faked, so that a criminal can send email that appears to come from the practice's real address to patients, staff or suppliers.

90%

of dental practices in England could be impersonated by email (3,004 of 3,325)

61%

have no DMARC record at all

10%

tell email providers to block or quarantine fake email in their name

have all three protections in place: SPF, DKIM and an enforced DMARC policy

Region	Practices checked	Could be impersonated
North East	92	92%
South East	682	92%
Yorkshire and the Humber	238	92%
East of England	335	91%
London	746	91%
West Midlands	280	91%
East Midlands	254	90%
North West	345	89%
South West	352	86%
England	3,325	90%

One practice website with no region recorded is included in the England total only. Checks ran on 16 October 2026 using public DNS records. No practice is named.

Read the full England report

Regional research · October 2026

Yorkshire healthcare email security benchmark

Our first benchmark covered 1,337 healthcare websites across Yorkshire: care homes, home care providers, GP practices and dental practices listed in the CQC directory.

All Yorkshire healthcare

83% could be impersonated

Of 1,337 care, GP and dental websites in Yorkshire, 83% had no email protection stopping someone sending fake email in their name.

Yorkshire dental practices

91% could be impersonated

220 of 243 Yorkshire dental practice websites had no DMARC policy telling receivers to block fakes.

Read the Yorkshire report

Data and citation

Download the data

Both datasets are free to reuse under Creative Commons Attribution 4.0. Please credit Unavoidably Secure and link to the report. The files hold totals and percentages only, with no practice or provider names.

How to cite

Unavoidably Secure (2026). England dental practice email security benchmark, October 2026. Unavoidable Studio Ltd. https://unavoidablysecure.com/benchmark/dental-england/

Unavoidably Secure (2026). Yorkshire healthcare email security benchmark, October 2026. Unavoidable Studio Ltd. https://unavoidablysecure.com/benchmark/

Source data: Care Quality Commission care directory, used under the Open Government Licence v3.0. Our method is set out in full on each report page.

Spokesperson

Andrew Heppinstall, founder

Andrew Heppinstall founded Unavoidably Secure, an independent compliance and web risk audit service for UK dental practices, care providers and other regulated small organisations, based in Leeds. He leads every audit himself.

Andrew has spent more than fourteen years building websites, systems and marketing for UK businesses, including dental and healthcare practices. He is the author of the Yorkshire and England email security benchmarks.

Andrew can comment on:

Email impersonation and phishing aimed at patients, families and suppliers
SPF, DKIM and DMARC explained in plain English
The NHS Data Security and Protection Toolkit (DSPT) and its deadlines
Cyber Essentials for small practices and care providers
Data protection, UK GDPR and PECR for small regulated organisations

Full profile and articles

Notes to editors

About Unavoidably Secure

Unavoidably Secure provides independent compliance and web risk audits for dental practices, care providers and regulated small organisations across the UK. It checks the public-facing risks regulators, insurers and attackers look at first, including email security, website security and cookie consent, and helps organisations prepare for the DSPT and Cyber Essentials. It also offers a free DMARC checker anyone can use.

Unavoidably Secure is a product of Unavoidable Studio Ltd, registered in England and Wales, company number 17367981, based in Leeds.

Media enquiries

For comment, interview, extra data or a regional breakdown, contact Andrew directly.